On this page
This is a translation; the German version is binding. Read in German (Drittsoftware)
This page lists the third-party software that is part of our download package or that its installation fetches onto your server, with licence and source.
The software runs on your own server; your documents do not leave it. The licences of the parts named here remain unaffected (EULA section 4); you receive the source code of the parts under GPL on request at info@ocr-software.com.
Operator: Helm & Nagel GmbH, Rosenweg 5, 35614 Aßlar, Germany. Questions about licences and requests for source code: info@ocr-software.com.
1. Website
| Component | Licence | Source |
|---|---|---|
JetBrains Mono (font, self-hosted, files latin and latin-ext) | SIL Open Font License 1.1 (text: assets/fonts/OFL-LICENSE.txt) | https://github.com/JetBrains/JetBrainsMono |
The website loads no third-party scripts and no fonts from third parties. It contains only our own scripts (gallery) and the font JetBrains Mono (SIL OFL 1.1), which we serve ourselves.
2. Service (Go)
| Component | Version | Licence | Source |
|---|---|---|---|
| Go (language, standard library, compiled in) | 1.26 | BSD-3-Clause | https://go.dev, https://go.googlesource.com/go |
| gopkg.in/yaml.v3 | v3.0.1 | MIT and Apache-2.0 (parts after libyaml, MIT); include the NOTICE | https://github.com/go-yaml/yaml |
Further Go modules in the programs of the package (as of 2026-11-06, licence files of the modules read):
| Module | Version | Licence | Use |
|---|---|---|---|
golang.org/x/image | v0.47.0 | BSD-3-Clause | TIFF decoder, CCITT tables, font data |
golang.org/x/text | v0.43.0 | BSD-3-Clause | Unicode normalisation NFKC (text matching) |
golang.org/x/sys | v0.49.0 | BSD-3-Clause | indirect |
github.com/aws/aws-sdk-go-v2 with credentials, service/s3, aws/protocol/eventstream, internal/configsources, internal/endpoints/v2, internal/v4a, service/internal/{accept-encoding,checksum,presigned-url,s3shared} | v1.47.5, v1.20.13, v1.114.6 and the subpackages per go.mod | Apache-2.0 | S3 input |
github.com/aws/smithy-go | v1.28.7 | Apache-2.0 | S3 input |
modernc.org/sqlite | v1.61.1 | BSD-3-Clause (module) and the embedded parts named below | SQLite driver of the ledger |
modernc.org/libc, modernc.org/mathutil, modernc.org/memory | v1.79.0, v1.7.1, v1.12.1 | BSD-3-Clause | indirect (sqlite) |
github.com/dustin/go-humanize | v1.1.0 | MIT | indirect (sqlite) |
github.com/google/uuid | v1.6.0 | BSD-3-Clause | indirect |
github.com/mattn/go-isatty | v0.0.24 | MIT | indirect (sqlite) |
github.com/ncruces/go-strftime | v1.1.0 | MIT | indirect (sqlite) |
github.com/remyoudompheng/bigfft | v0.0.0-20230129092748-24d4a6f8daec | BSD-3-Clause | indirect (sqlite) |
Embedded parts of modernc.org/sqlite (LICENSE-3RD-PARTY.md, LICENSE-SQLITE read in the module): SQLite itself (public domain, blessing), musl libc (MIT), go-netdb (MIT), nixpkgs (MIT); sqlite-vec (MIT) is contained in the module but not used by the ledger.
For testing only, not in the package: github.com/johannesboyne/gofakes3 v1.2.0 (MIT), github.com/ryszard/goskiplist (Apache-2.0), go.shabbyrobe.org/gocovmerge (BSD), golang.org/x/tools v0.52.0 (BSD-3-Clause). The file NOTICE in the package contains the licence texts of every compiled-in module. BSD-3 and MIT require the notice when passing on in binary form: with the download we pass on the binaries and include the texts (file NOTICE).
3. PDF processing (separate processes)
| Component | Licence | Source |
|---|---|---|
poppler (pdfinfo, pdftoppm, pdftotext; package poppler-utils) | GPL-2.0 or GPL-3.0 (Debian copyright; contributions GPL-2.0-or-later) | https://poppler.freedesktop.org, https://gitlab.freedesktop.org/poppler/poppler |
On your server poppler runs as a separate child process of the service: the service starts pdfinfo and pdftoppm, passes only command-line arguments and file paths, and reads the result from files and standard output. poppler is not linked, not embedded and not modified. We do not pass poppler on: the package contains no poppler; you obtain poppler-utils from the Ubuntu sources on your server.
Classification (GNU GPL FAQ, retrieved 2026-11-04, https://www.gnu.org/licenses/gpl-faq.html): pipes, sockets and command-line arguments are normal means of communication between separate programs (#MereAggregation); the GPL allows using modified versions without passing them on (#UnreleasedMods). Duties regarding source code arise on passing on, not on running.
Ubuntu builds and links poppler with further libraries (freetype, lcms2, libjpeg, libpng, openjpeg, tiff, zlib, fontconfig and others); they are Ubuntu packages on the server, and their licences are in /usr/share/doc/<package>/copyright. On your server apt-cache depends poppler-utils shows the list.
4. Text recognition (models and runtime)
| Component | Version | Licence | Source |
|---|---|---|---|
| PP-OCRv6 medium det (weights) | Revision 8e0f56fb2ef86b461d99cfc7ac5c137738985f61 | Apache-2.0 (model card, retrieved 2026-11-04; no training data named); we make no statement on the origin of the training data | https://huggingface.co/PaddlePaddle/PP-OCRv6_medium_det |
| PP-OCRv6 medium rec (weights) | Revision e5a92bcbc5cc1b494628e458d267778f0704fd7c | Apache-2.0 (model card, retrieved 2026-11-04; no training data named); training data as above | https://huggingface.co/PaddlePaddle/PP-OCRv6_medium_rec |
PP-LCNet_x1_0_doc_ori (page orientation, scan-ctc-rotate) | revision and SHA-256 shown by ocr-fetch-models.sh --list | Apache-2.0 (model card; training data not named); training data as for PP-OCRv6 | https://huggingface.co/PaddlePaddle/PP-LCNet_x1_0_doc_ori |
| PaddleOCR | 3.7.0 | Apache-2.0 (LICENSE in the repository) | https://github.com/PaddlePaddle/PaddleOCR |
| PaddleX | 3.7.2 | Apache-2.0 | https://github.com/PaddlePaddle/PaddleX |
| PaddlePaddle (GPU) | 3.2.0 | Apache-2.0 (LICENSE in the repository; the wheel is not on PyPI) | https://github.com/PaddlePaddle/Paddle |
Apache-2.0: include the licence text and NOTICE, mark changes. We do not modify these packages and weights. If retraining or conversion comes, we add a change notice and a licence line of our own before use.
5. Python libraries of text recognition (dependencies)
Text recognition runs in Python environments on your server. The package does not contain them: ocr-fetch-models.sh fetches the packages in fixed versions with a checksum from PyPI, download.pytorch.org and paddlepaddle.org.cn after you have seen the list and agreed (--list shows it without downloading anything). The table summarises the packages of all environments; licences per PyPI metadata of the pinned version, retrieved 2026-11-06. No GPL, AGPL or NC package found; LGPL and MPL packages are marked. Versions differ per environment (for example pillow 12.1.0 and 12.3.0, numpy 1.26.4 and 2.2.6); what counts is what ocr-fetch-models.sh --list shows for your environment.
| Component | Version | Licence | Source |
|---|---|---|---|
| numpy | 2.2.6 | BSD-3-Clause | https://github.com/numpy/numpy |
| pillow | 12.1.0 | MIT-CMU (PyPI) | https://github.com/python-pillow/Pillow |
| opencv-contrib-python (environments for layout and PP-OCRv6), opencv-python-headless (environments for OPT and tables) | 4.10.0.84 | Apache-2.0; the wheel bundles FFmpeg (LGPL-2.1) and, in the non-headless wheel opencv-contrib-python, Qt 5 (LGPL-3.0) (opencv-python README, retrieved 2026-11-04). opencv-contrib-python (with Qt) runs in the layout environment. Running without passing on does not trigger the LGPL duties; on your server the wheels lie unmodified and replaceable in the Python environment | https://github.com/opencv/opencv-python |
| shapely | 2.1.2 | BSD-3-Clause (PyPI); the wheel bundles GEOS (LGPL-2.1); the licence text of the GEOS part is in the wheel | https://github.com/shapely/shapely |
| pyclipper | 1.4.0 | MIT (Clipper: Boost) | https://github.com/greginvm/pyclipper |
| pypdfium2 | 5.14.0 | BSD-3-Clause, Apache-2.0 and licences of the bundled dependencies (PyPI) | https://github.com/pypdfium2-team/pypdfium2 |
| pandas | 2.3.3 | BSD-3-Clause | https://github.com/pandas-dev/pandas |
| networkx | 3.4.2 | BSD-3-Clause | https://github.com/networkx/networkx |
| protobuf | 6.33.4 | BSD-3-Clause | https://github.com/protocolbuffers/protobuf |
| pydantic, pydantic_core | 2.14.2, 2.50.2 | MIT | https://github.com/pydantic/pydantic |
| PyYAML | 6.0.2 | MIT | https://github.com/yaml/pyyaml |
| ruamel.yaml | 0.19.1 | MIT | https://sourceforge.net/projects/ruamel-yaml/ |
| requests, httpx, httpcore, h11 | 2.34.2, 0.28.1, 1.0.9, 0.16.0 | Apache-2.0 (requests), BSD-3-Clause (others) | https://github.com/psf/requests, https://github.com/encode/httpx |
| aiohttp, aiosignal, frozenlist, multidict, yarl, propcache, aiohappyeyeballs | per --list | Apache-2.0 (family), aiohappyeyeballs PSF-2.0 | https://github.com/aio-libs |
| urllib3, idna, anyio, attrs, six, python-dateutil, pytz, tzdata | per --list | MIT / BSD / Apache-2.0 (per package) | PyPI project pages |
| certifi | 2026.1.4 | MPL-2.0 (unmodified, file level) | https://github.com/certifi/python-certifi |
| tqdm | 4.70.1 | MPL-2.0 and MIT | https://github.com/tqdm/tqdm |
| chardet, charset-normalizer | 7.7.0, 3.5.2 | chardet: 0BSD (earlier versions LGPL); charset-normalizer: MIT (PyPI) | https://github.com/chardet/chardet |
| python-bidi | 0.6.12 | LGPL (PyPI classifier; the repository contains COPYING and COPYING.LESSER, Rust wrapper); the exact LGPL version is in the wheel; notice and replacement duties apply only on passing on (download: wheel unmodified and replaceable) | https://github.com/MeirKriheli/python-bidi |
| cssutils, encutils | 2.15.0, 1.0.0 | LGPL-3.0-or-later (PyPI metadata); in the layout environment (they come via premailer 3.10.0, licence "Python"); duties only on passing on (download: package unmodified and replaceable) | https://github.com/jaraco/cssutils |
| cryptography, cffi, pycparser | 50.0.2, 2.1.1, 3.11 | Apache-2.0 or BSD-3-Clause; MIT-0; BSD-3-Clause | https://github.com/pyca/cryptography |
| pycryptodome, crc32c, bce-python-sdk | 4.3.0, 2.9.post0, 0.9.79 | BSD-2-Clause, Unlicense and MIT; crc32c: LGPL-2.1-or-later (PyPI; duties only on passing on); Apache-2.0 | PyPI project pages |
| huggingface-hub, hf-xet, safetensors, modelscope, modelscope-hub, aistudio_sdk | 0.34.4, 1.8.0, 0.7.0, 1.40.2, 0.6.1, 0.3.9 | Apache-2.0 (PyPI) | https://github.com/huggingface |
| psutil, py-cpuinfo, pynvml, nvidia-ml-py | per --list | BSD-3-Clause; MIT; BSD-3-Clause; BSD-3-Clause | PyPI project pages |
| onnx, onnxruntime, onnxruntime-gpu, onnxconverter-common, onnxoptimizer, openvino, openvino-telemetry, paddle2onnx, paddlepaddle, polygraphy, flatbuffers, coloredlogs, humanfriendly | 1.17.0, 1.22.1, 1.23.2, 1.14.0, 0.3.13, 2024.6.0, 2025.2.0, 2.0.1, 3.2.0, 0.53.6, 25.12.19, 15.0.1, 10.0 | Apache-2.0 or MIT (onnxruntime, onnxconverter-common, coloredlogs, humanfriendly); environments for layout and OPT | PyPI project pages |
| torch, torchvision, triton, transformers, tokenizers, timm, docling-ibm-models, einops, sentencepiece, tiktoken, scikit-learn, scipy, joblib, threadpoolctl, sympy, mpmath, lxml, regex, rich, typer, shellingham | 2.13.0, 0.28.0, 3.7.1, 5.17.0, 0.23.3, 1.0.31, 4.0.4, 0.8.2, 0.2.2, 0.14.0, 1.7.2, 1.15.3 and others | torch: BSD family (Apache-2.0 with LLVM exception, BSD-2/3 and others per PyPI); torchvision BSD; triton MIT; transformers, tokenizers, timm, sentencepiece Apache-2.0; docling-ibm-models MIT; einops, tiktoken, rich, typer MIT; scikit-learn, scipy, joblib, threadpoolctl, sympy, mpmath, lxml BSD; regex Apache-2.0 and CNRI-Python; shellingham ISC. Environments for layout and tables. Note: the docling-ibm-models/TableFormer weights carry CDLA-Permissive-2.0 and Apache-2.0 | PyPI project pages |
| openai, jiter, beautifulsoup4, soupsieve, cssselect, premailer, openpyxl, et_xmlfile, ftfy, latex2mathml, cachetools, cloudpickle, more-itertools, pluggy, pytest, iniconfig, tomli, truststore, Jinja2, MarkupSafe, Pygments, markdown-it-py, mdurl, apted, httpcore2, httpx2 | per --list | MIT, BSD, Apache-2.0 (openai, ftfy), Python licence (premailer) per PyPI | PyPI project pages |
| ujson, colorlog, click, prettytable, wcwidth, typing_extensions, typing-inspection, annotated-types, packaging, filelock, fsspec, future, imagesize, opt-einsum, exceptiongroup, async-timeout | per --list | BSD/MIT/Apache-2.0/PSF-2.0 per PyPI; ujson BSD-3-Clause and TCL | PyPI project pages |
6. GPU runtime (NVIDIA, not open source)
| Component | Version | Licence | Source |
|---|---|---|---|
NVIDIA CUDA libraries (cuBLAS, cuDNN, cuFFT, cuSOLVER, cuSPARSE, cuRAND, NCCL, NVRTC and others, as Python packages nvidia-*) | CUDA 12.9 and cuDNN 9.9 (layout, PP-OCRv6); CUDA 13.0 and cuDNN 9.20 (tables); on the host cuda-toolkit-12-8, cuda-toolkit-13-0, cudnn 9.27.0-1 | NVIDIA SDK and cuDNN licence (proprietary, free of charge). Exceptions: NCCL BSD-3-Clause, nvtx Apache-2.0 (PyPI). cuDNN has a licence of its own (v. 22 Feb 2022) | https://docs.nvidia.com/cuda/eula/index.html (as of 26 Jan 2026), https://docs.nvidia.com/deeplearning/cudnn/backend/latest/reference/eula.html |
| NVIDIA driver (operating system of the GPU server) | 580 | proprietary, free of charge; you install it yourself; our package never installs, changes or removes it | https://www.nvidia.com/drivers |
Under the CUDA EULA (retrieved 2026-11-04) the libraries may be passed on only embedded in an application with substantial functionality of its own, unmodified, without sublicence and used only by that application. We do not pass the libraries on. We ship no NVIDIA components: you obtain the driver and CUDA packages on your server from NVIDIA's sources and accept their terms yourself. We do not ship a finished image with these libraries. The packages are proprietary but usable without payment.
7. Operating system
The software runs on your own server (Ubuntu 22.04, amd64) with Python environments and systemd services; Docker is not needed. The licences of the Ubuntu packages (GPL, LGPL and others) are on your server under /usr/share/doc/<package>/copyright; we pass on no images and no packages (section 6). On request we set up a server of your own at Hetzner Online GmbH in Germany; the same licences apply to it.
8. Not in the service
For measuring and testing only, not in the package: pillow, numpy, pytest and their dependencies.
Measurement environment only (not in the package): Unidecode (GPL-2+, doctr), easydict (LGPL-3), pycountry (LGPL-2.1), pyphen (GPL/LGPL/MPL); (cssutils and encutils, by contrast, are in the layout environment, see section 5.)
9. Maintenance and enquiries
- AGPL parts: none as of 2026-11-04 (all Python lists and Go modules checked).
- Maintenance: we regenerate the list with every new release.
- The licence texts of the Go modules are in the file
NOTICEin the package. - Enquiries about licences and about the source code of the parts under GPL: info@ocr-software.com. We usually answer within three working days and deliver the source code within 30 days.